<!DOCTYPE html>
<html lang="en-US" >
<head>

<link rel="profile" href="http://gmpg.org/xfn/11" />
<link rel="pingback" href="https://blog.lumen.com/xmlrpc.php" />

 

<meta name='robots' content='index, follow, max-image-preview:large, max-snippet:-1, max-video-preview:-1' />

	<!-- This site is optimized with the Yoast SEO plugin v20.7 - https://yoast.com/wordpress/plugins/seo/ -->
	<title>Routers from the Underground: Exposing AVrecon - Lumen</title>
	<meta name="description" content="Lumen Black Lotus Labs® identified a complex operation that infects small-office/home-office (SOHO) routers we’ve dubbed “AVrecon.”" />
	<link rel="canonical" href="https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/" />
	<meta property="og:locale" content="en_US" />
	<meta property="og:type" content="article" />
	<meta property="og:title" content="Routers from the Underground: Exposing AVrecon - Lumen" />
	<meta property="og:description" content="Lumen Black Lotus Labs® identified a complex operation that infects small-office/home-office (SOHO) routers we’ve dubbed “AVrecon.”" />
	<meta property="og:url" content="https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/" />
	<meta property="og:site_name" content="Lumen" />
	<meta property="article:published_time" content="2023-07-12T13:45:21+00:00" />
	<meta property="article:modified_time" content="2023-07-12T14:39:29+00:00" />
	<meta property="og:image" content="http://blog.lumen.com/wp-content/uploads/2023/07/AVrecon.jpg" />
	<meta property="og:image:width" content="848" />
	<meta property="og:image:height" content="563" />
	<meta property="og:image:type" content="image/jpeg" />
	<meta name="author" content="Black Lotus Labs" />
	<meta name="twitter:card" content="summary_large_image" />
	<meta name="twitter:label1" content="Written by" />
	<meta name="twitter:data1" content="Black Lotus Labs" />
	<meta name="twitter:label2" content="Est. reading time" />
	<meta name="twitter:data2" content="12 minutes" />
	<script type="application/ld+json" class="yoast-schema-graph">{"@context":"https://schema.org","@graph":[{"@type":"WebPage","@id":"https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/","url":"https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/","name":"Routers from the Underground: Exposing AVrecon - Lumen","isPartOf":{"@id":"https://blog.lumen.com/#website"},"primaryImageOfPage":{"@id":"https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/#primaryimage"},"image":{"@id":"https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/#primaryimage"},"thumbnailUrl":"https://blog.lumen.com/wp-content/uploads/2023/07/AVrecon.jpg","datePublished":"2023-07-12T13:45:21+00:00","dateModified":"2023-07-12T14:39:29+00:00","author":{"@id":"https://blog.lumen.com/#/schema/person/6effac3de32752253a0be02ea99a7ccc"},"description":"Lumen Black Lotus Labs® identified a complex operation that infects small-office/home-office (SOHO) routers we’ve dubbed “AVrecon.”","breadcrumb":{"@id":"https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/#breadcrumb"},"inLanguage":"en-US","potentialAction":[{"@type":"ReadAction","target":["https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"]}]},{"@type":"ImageObject","inLanguage":"en-US","@id":"https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/#primaryimage","url":"https://blog.lumen.com/wp-content/uploads/2023/07/AVrecon.jpg","contentUrl":"https://blog.lumen.com/wp-content/uploads/2023/07/AVrecon.jpg","width":848,"height":563,"caption":"Computer code shown on blue background"},{"@type":"BreadcrumbList","@id":"https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/#breadcrumb","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://blog.lumen.com/"},{"@type":"ListItem","position":2,"name":"Sample post page","item":"https://blog.lumen.com/?page_id=4365"},{"@type":"ListItem","position":3,"name":"Routers from the Underground: Exposing AVrecon"}]},{"@type":"WebSite","@id":"https://blog.lumen.com/#website","url":"https://blog.lumen.com/","name":"Lumen","description":"Lumen&#039;s Blog","potentialAction":[{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://blog.lumen.com/?s={search_term_string}"},"query-input":"required name=search_term_string"}],"inLanguage":"en-US"},{"@type":"Person","@id":"https://blog.lumen.com/#/schema/person/6effac3de32752253a0be02ea99a7ccc","name":"Black Lotus Labs","image":{"@type":"ImageObject","inLanguage":"en-US","@id":"https://blog.lumen.com/#/schema/person/image/","url":"https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-100x100.png","contentUrl":"https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-100x100.png","caption":"Black Lotus Labs"},"description":"The mission of Black Lotus Labs is to leverage our network visibility to help protect customers and keep the internet clean.","url":"https://blog.lumen.com/author/black-lotus-labs/"}]}</script>
	<!-- / Yoast SEO plugin. -->


<link rel='dns-prefetch' href='//static.addtoany.com' />
<link rel='dns-prefetch' href='//players.brightcove.net' />
<link rel='dns-prefetch' href='//fonts.googleapis.com' />
<link rel='dns-prefetch' href='//www.googletagmanager.com' />
<link rel="alternate" type="application/rss+xml" title="Lumen &raquo; Feed" href="https://blog.lumen.com/feed/" />
<meta charset="UTF-8" /><meta name="viewport" content="width=device-width, initial-scale=1, maximum-scale=1" /><meta name="format-detection" content="telephone=no"><meta property="og:type" content="article" /><meta property="og:image" content="https://blog.lumen.com/wp-content/uploads/2023/07/AVrecon.jpg"/><meta property="og:title" content="Routers from the Underground: Exposing AVrecon"/><meta property="og:url" content="https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"/><meta property="og:description" content=""/>		<!-- This site uses the Google Analytics by MonsterInsights plugin v8.14.1 - Using Analytics tracking - https://www.monsterinsights.com/ -->
							<script src="//www.googletagmanager.com/gtag/js?id=UA-41153014-24"  data-cfasync="false" data-wpfc-render="false" type="text/javascript" async></script>
			<script data-cfasync="false" data-wpfc-render="false" type="text/javascript">
				var mi_version = '8.14.1';
				var mi_track_user = true;
				var mi_no_track_reason = '';
				
								var disableStrs = [
															'ga-disable-UA-41153014-24',
									];

				/* Function to detect opted out users */
				function __gtagTrackerIsOptedOut() {
					for (var index = 0; index < disableStrs.length; index++) {
						if (document.cookie.indexOf(disableStrs[index] + '=true') > -1) {
							return true;
						}
					}

					return false;
				}

				/* Disable tracking if the opt-out cookie exists. */
				if (__gtagTrackerIsOptedOut()) {
					for (var index = 0; index < disableStrs.length; index++) {
						window[disableStrs[index]] = true;
					}
				}

				/* Opt-out function */
				function __gtagTrackerOptout() {
					for (var index = 0; index < disableStrs.length; index++) {
						document.cookie = disableStrs[index] + '=true; expires=Thu, 31 Dec 2099 23:59:59 UTC; path=/';
						window[disableStrs[index]] = true;
					}
				}

				if ('undefined' === typeof gaOptout) {
					function gaOptout() {
						__gtagTrackerOptout();
					}
				}
								window.dataLayer = window.dataLayer || [];

				window.MonsterInsightsDualTracker = {
					helpers: {},
					trackers: {},
				};
				if (mi_track_user) {
					function __gtagDataLayer() {
						dataLayer.push(arguments);
					}

					function __gtagTracker(type, name, parameters) {
						if (!parameters) {
							parameters = {};
						}

						if (parameters.send_to) {
							__gtagDataLayer.apply(null, arguments);
							return;
						}

						if (type === 'event') {
							
														parameters.send_to = monsterinsights_frontend.ua;
							__gtagDataLayer(type, name, parameters);
													} else {
							__gtagDataLayer.apply(null, arguments);
						}
					}

					__gtagTracker('js', new Date());
					__gtagTracker('set', {
						'developer_id.dZGIzZG': true,
											});
															__gtagTracker('config', 'UA-41153014-24', {"forceSSL":"true","link_attribution":"true"} );
										window.gtag = __gtagTracker;										(function () {
						/* https://developers.google.com/analytics/devguides/collection/analyticsjs/ */
						/* ga and __gaTracker compatibility shim. */
						var noopfn = function () {
							return null;
						};
						var newtracker = function () {
							return new Tracker();
						};
						var Tracker = function () {
							return null;
						};
						var p = Tracker.prototype;
						p.get = noopfn;
						p.set = noopfn;
						p.send = function () {
							var args = Array.prototype.slice.call(arguments);
							args.unshift('send');
							__gaTracker.apply(null, args);
						};
						var __gaTracker = function () {
							var len = arguments.length;
							if (len === 0) {
								return;
							}
							var f = arguments[len - 1];
							if (typeof f !== 'object' || f === null || typeof f.hitCallback !== 'function') {
								if ('send' === arguments[0]) {
									var hitConverted, hitObject = false, action;
									if ('event' === arguments[1]) {
										if ('undefined' !== typeof arguments[3]) {
											hitObject = {
												'eventAction': arguments[3],
												'eventCategory': arguments[2],
												'eventLabel': arguments[4],
												'value': arguments[5] ? arguments[5] : 1,
											}
										}
									}
									if ('pageview' === arguments[1]) {
										if ('undefined' !== typeof arguments[2]) {
											hitObject = {
												'eventAction': 'page_view',
												'page_path': arguments[2],
											}
										}
									}
									if (typeof arguments[2] === 'object') {
										hitObject = arguments[2];
									}
									if (typeof arguments[5] === 'object') {
										Object.assign(hitObject, arguments[5]);
									}
									if ('undefined' !== typeof arguments[1].hitType) {
										hitObject = arguments[1];
										if ('pageview' === hitObject.hitType) {
											hitObject.eventAction = 'page_view';
										}
									}
									if (hitObject) {
										action = 'timing' === arguments[1].hitType ? 'timing_complete' : hitObject.eventAction;
										hitConverted = mapArgs(hitObject);
										__gtagTracker('event', action, hitConverted);
									}
								}
								return;
							}

							function mapArgs(args) {
								var arg, hit = {};
								var gaMap = {
									'eventCategory': 'event_category',
									'eventAction': 'event_action',
									'eventLabel': 'event_label',
									'eventValue': 'event_value',
									'nonInteraction': 'non_interaction',
									'timingCategory': 'event_category',
									'timingVar': 'name',
									'timingValue': 'value',
									'timingLabel': 'event_label',
									'page': 'page_path',
									'location': 'page_location',
									'title': 'page_title',
								};
								for (arg in args) {
																		if (!(!args.hasOwnProperty(arg) || !gaMap.hasOwnProperty(arg))) {
										hit[gaMap[arg]] = args[arg];
									} else {
										hit[arg] = args[arg];
									}
								}
								return hit;
							}

							try {
								f.hitCallback();
							} catch (ex) {
							}
						};
						__gaTracker.create = newtracker;
						__gaTracker.getByName = newtracker;
						__gaTracker.getAll = function () {
							return [];
						};
						__gaTracker.remove = noopfn;
						__gaTracker.loaded = true;
						window['__gaTracker'] = __gaTracker;
					})();
									} else {
										console.log("");
					(function () {
						function __gtagTracker() {
							return null;
						}

						window['__gtagTracker'] = __gtagTracker;
						window['gtag'] = __gtagTracker;
					})();
									}
			</script>
				<!-- / Google Analytics by MonsterInsights -->
		<script type="text/javascript">
window._wpemojiSettings = {"baseUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/72x72\/","ext":".png","svgUrl":"https:\/\/s.w.org\/images\/core\/emoji\/14.0.0\/svg\/","svgExt":".svg","source":{"concatemoji":"https:\/\/blog.lumen.com\/wp-includes\/js\/wp-emoji-release.min.js"}};
/*! This file is auto-generated */
!function(e,a,t){var n,r,o,i=a.createElement("canvas"),p=i.getContext&&i.getContext("2d");function s(e,t){p.clearRect(0,0,i.width,i.height),p.fillText(e,0,0);e=i.toDataURL();return p.clearRect(0,0,i.width,i.height),p.fillText(t,0,0),e===i.toDataURL()}function c(e){var t=a.createElement("script");t.src=e,t.defer=t.type="text/javascript",a.getElementsByTagName("head")[0].appendChild(t)}for(o=Array("flag","emoji"),t.supports={everything:!0,everythingExceptFlag:!0},r=0;r<o.length;r++)t.supports[o[r]]=function(e){if(p&&p.fillText)switch(p.textBaseline="top",p.font="600 32px Arial",e){case"flag":return s("\ud83c\udff3\ufe0f\u200d\u26a7\ufe0f","\ud83c\udff3\ufe0f\u200b\u26a7\ufe0f")?!1:!s("\ud83c\uddfa\ud83c\uddf3","\ud83c\uddfa\u200b\ud83c\uddf3")&&!s("\ud83c\udff4\udb40\udc67\udb40\udc62\udb40\udc65\udb40\udc6e\udb40\udc67\udb40\udc7f","\ud83c\udff4\u200b\udb40\udc67\u200b\udb40\udc62\u200b\udb40\udc65\u200b\udb40\udc6e\u200b\udb40\udc67\u200b\udb40\udc7f");case"emoji":return!s("\ud83e\udef1\ud83c\udffb\u200d\ud83e\udef2\ud83c\udfff","\ud83e\udef1\ud83c\udffb\u200b\ud83e\udef2\ud83c\udfff")}return!1}(o[r]),t.supports.everything=t.supports.everything&&t.supports[o[r]],"flag"!==o[r]&&(t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&t.supports[o[r]]);t.supports.everythingExceptFlag=t.supports.everythingExceptFlag&&!t.supports.flag,t.DOMReady=!1,t.readyCallback=function(){t.DOMReady=!0},t.supports.everything||(n=function(){t.readyCallback()},a.addEventListener?(a.addEventListener("DOMContentLoaded",n,!1),e.addEventListener("load",n,!1)):(e.attachEvent("onload",n),a.attachEvent("onreadystatechange",function(){"complete"===a.readyState&&t.readyCallback()})),(e=t.source||{}).concatemoji?c(e.concatemoji):e.wpemoji&&e.twemoji&&(c(e.twemoji),c(e.wpemoji)))}(window,document,window._wpemojiSettings);
</script>
<style type="text/css">
img.wp-smiley,
img.emoji {
	display: inline !important;
	border: none !important;
	box-shadow: none !important;
	height: 1em !important;
	width: 1em !important;
	margin: 0 0.07em !important;
	vertical-align: -0.1em !important;
	background: none !important;
	padding: 0 !important;
}
</style>
	<link rel='stylesheet' id='wp-block-library-css' href='https://blog.lumen.com/wp-includes/css/dist/block-library/style.min.css' type='text/css' media='all' />
<link rel='stylesheet' id='classic-theme-styles-css' href='https://blog.lumen.com/wp-includes/css/classic-themes.min.css' type='text/css' media='all' />
<style id='global-styles-inline-css' type='text/css'>
body{--wp--preset--color--black: #000000;--wp--preset--color--cyan-bluish-gray: #abb8c3;--wp--preset--color--white: #ffffff;--wp--preset--color--pale-pink: #f78da7;--wp--preset--color--vivid-red: #cf2e2e;--wp--preset--color--luminous-vivid-orange: #ff6900;--wp--preset--color--luminous-vivid-amber: #fcb900;--wp--preset--color--light-green-cyan: #7bdcb5;--wp--preset--color--vivid-green-cyan: #00d084;--wp--preset--color--pale-cyan-blue: #8ed1fc;--wp--preset--color--vivid-cyan-blue: #0693e3;--wp--preset--color--vivid-purple: #9b51e0;--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple: linear-gradient(135deg,rgba(6,147,227,1) 0%,rgb(155,81,224) 100%);--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan: linear-gradient(135deg,rgb(122,220,180) 0%,rgb(0,208,130) 100%);--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange: linear-gradient(135deg,rgba(252,185,0,1) 0%,rgba(255,105,0,1) 100%);--wp--preset--gradient--luminous-vivid-orange-to-vivid-red: linear-gradient(135deg,rgba(255,105,0,1) 0%,rgb(207,46,46) 100%);--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray: linear-gradient(135deg,rgb(238,238,238) 0%,rgb(169,184,195) 100%);--wp--preset--gradient--cool-to-warm-spectrum: linear-gradient(135deg,rgb(74,234,220) 0%,rgb(151,120,209) 20%,rgb(207,42,186) 40%,rgb(238,44,130) 60%,rgb(251,105,98) 80%,rgb(254,248,76) 100%);--wp--preset--gradient--blush-light-purple: linear-gradient(135deg,rgb(255,206,236) 0%,rgb(152,150,240) 100%);--wp--preset--gradient--blush-bordeaux: linear-gradient(135deg,rgb(254,205,165) 0%,rgb(254,45,45) 50%,rgb(107,0,62) 100%);--wp--preset--gradient--luminous-dusk: linear-gradient(135deg,rgb(255,203,112) 0%,rgb(199,81,192) 50%,rgb(65,88,208) 100%);--wp--preset--gradient--pale-ocean: linear-gradient(135deg,rgb(255,245,203) 0%,rgb(182,227,212) 50%,rgb(51,167,181) 100%);--wp--preset--gradient--electric-grass: linear-gradient(135deg,rgb(202,248,128) 0%,rgb(113,206,126) 100%);--wp--preset--gradient--midnight: linear-gradient(135deg,rgb(2,3,129) 0%,rgb(40,116,252) 100%);--wp--preset--duotone--dark-grayscale: url('#wp-duotone-dark-grayscale');--wp--preset--duotone--grayscale: url('#wp-duotone-grayscale');--wp--preset--duotone--purple-yellow: url('#wp-duotone-purple-yellow');--wp--preset--duotone--blue-red: url('#wp-duotone-blue-red');--wp--preset--duotone--midnight: url('#wp-duotone-midnight');--wp--preset--duotone--magenta-yellow: url('#wp-duotone-magenta-yellow');--wp--preset--duotone--purple-green: url('#wp-duotone-purple-green');--wp--preset--duotone--blue-orange: url('#wp-duotone-blue-orange');--wp--preset--font-size--small: 13px;--wp--preset--font-size--medium: 20px;--wp--preset--font-size--large: 36px;--wp--preset--font-size--x-large: 42px;--wp--preset--spacing--20: 0.44rem;--wp--preset--spacing--30: 0.67rem;--wp--preset--spacing--40: 1rem;--wp--preset--spacing--50: 1.5rem;--wp--preset--spacing--60: 2.25rem;--wp--preset--spacing--70: 3.38rem;--wp--preset--spacing--80: 5.06rem;--wp--preset--shadow--natural: 6px 6px 9px rgba(0, 0, 0, 0.2);--wp--preset--shadow--deep: 12px 12px 50px rgba(0, 0, 0, 0.4);--wp--preset--shadow--sharp: 6px 6px 0px rgba(0, 0, 0, 0.2);--wp--preset--shadow--outlined: 6px 6px 0px -3px rgba(255, 255, 255, 1), 6px 6px rgba(0, 0, 0, 1);--wp--preset--shadow--crisp: 6px 6px 0px rgba(0, 0, 0, 1);}:where(.is-layout-flex){gap: 0.5em;}body .is-layout-flow > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-flow > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-flow > .aligncenter{margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignleft{float: left;margin-inline-start: 0;margin-inline-end: 2em;}body .is-layout-constrained > .alignright{float: right;margin-inline-start: 2em;margin-inline-end: 0;}body .is-layout-constrained > .aligncenter{margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > :where(:not(.alignleft):not(.alignright):not(.alignfull)){max-width: var(--wp--style--global--content-size);margin-left: auto !important;margin-right: auto !important;}body .is-layout-constrained > .alignwide{max-width: var(--wp--style--global--wide-size);}body .is-layout-flex{display: flex;}body .is-layout-flex{flex-wrap: wrap;align-items: center;}body .is-layout-flex > *{margin: 0;}:where(.wp-block-columns.is-layout-flex){gap: 2em;}.has-black-color{color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-color{color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-color{color: var(--wp--preset--color--white) !important;}.has-pale-pink-color{color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-color{color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-color{color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-color{color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-color{color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-color{color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-color{color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-color{color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-color{color: var(--wp--preset--color--vivid-purple) !important;}.has-black-background-color{background-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-background-color{background-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-background-color{background-color: var(--wp--preset--color--white) !important;}.has-pale-pink-background-color{background-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-background-color{background-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-background-color{background-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-background-color{background-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-background-color{background-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-background-color{background-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-background-color{background-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-background-color{background-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-background-color{background-color: var(--wp--preset--color--vivid-purple) !important;}.has-black-border-color{border-color: var(--wp--preset--color--black) !important;}.has-cyan-bluish-gray-border-color{border-color: var(--wp--preset--color--cyan-bluish-gray) !important;}.has-white-border-color{border-color: var(--wp--preset--color--white) !important;}.has-pale-pink-border-color{border-color: var(--wp--preset--color--pale-pink) !important;}.has-vivid-red-border-color{border-color: var(--wp--preset--color--vivid-red) !important;}.has-luminous-vivid-orange-border-color{border-color: var(--wp--preset--color--luminous-vivid-orange) !important;}.has-luminous-vivid-amber-border-color{border-color: var(--wp--preset--color--luminous-vivid-amber) !important;}.has-light-green-cyan-border-color{border-color: var(--wp--preset--color--light-green-cyan) !important;}.has-vivid-green-cyan-border-color{border-color: var(--wp--preset--color--vivid-green-cyan) !important;}.has-pale-cyan-blue-border-color{border-color: var(--wp--preset--color--pale-cyan-blue) !important;}.has-vivid-cyan-blue-border-color{border-color: var(--wp--preset--color--vivid-cyan-blue) !important;}.has-vivid-purple-border-color{border-color: var(--wp--preset--color--vivid-purple) !important;}.has-vivid-cyan-blue-to-vivid-purple-gradient-background{background: var(--wp--preset--gradient--vivid-cyan-blue-to-vivid-purple) !important;}.has-light-green-cyan-to-vivid-green-cyan-gradient-background{background: var(--wp--preset--gradient--light-green-cyan-to-vivid-green-cyan) !important;}.has-luminous-vivid-amber-to-luminous-vivid-orange-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-amber-to-luminous-vivid-orange) !important;}.has-luminous-vivid-orange-to-vivid-red-gradient-background{background: var(--wp--preset--gradient--luminous-vivid-orange-to-vivid-red) !important;}.has-very-light-gray-to-cyan-bluish-gray-gradient-background{background: var(--wp--preset--gradient--very-light-gray-to-cyan-bluish-gray) !important;}.has-cool-to-warm-spectrum-gradient-background{background: var(--wp--preset--gradient--cool-to-warm-spectrum) !important;}.has-blush-light-purple-gradient-background{background: var(--wp--preset--gradient--blush-light-purple) !important;}.has-blush-bordeaux-gradient-background{background: var(--wp--preset--gradient--blush-bordeaux) !important;}.has-luminous-dusk-gradient-background{background: var(--wp--preset--gradient--luminous-dusk) !important;}.has-pale-ocean-gradient-background{background: var(--wp--preset--gradient--pale-ocean) !important;}.has-electric-grass-gradient-background{background: var(--wp--preset--gradient--electric-grass) !important;}.has-midnight-gradient-background{background: var(--wp--preset--gradient--midnight) !important;}.has-small-font-size{font-size: var(--wp--preset--font-size--small) !important;}.has-medium-font-size{font-size: var(--wp--preset--font-size--medium) !important;}.has-large-font-size{font-size: var(--wp--preset--font-size--large) !important;}.has-x-large-font-size{font-size: var(--wp--preset--font-size--x-large) !important;}
.wp-block-navigation a:where(:not(.wp-element-button)){color: inherit;}
:where(.wp-block-columns.is-layout-flex){gap: 2em;}
.wp-block-pullquote{font-size: 1.5em;line-height: 1.6;}
</style>
<link rel='stylesheet' id='authors-list-css-css' href='https://blog.lumen.com/wp-content/plugins/authors-list/backend/assets/css/front.css' type='text/css' media='all' />
<link rel='stylesheet' id='jquery-ui-css-css' href='https://blog.lumen.com/wp-content/plugins/authors-list/backend/assets/css/jquery-ui.css' type='text/css' media='all' />
<link rel='stylesheet' id='uaf_client_css-css' href='https://blog.lumen.com/wp-content/uploads/useanyfont/uaf.css' type='text/css' media='all' />
<link rel='stylesheet' id='ppress-frontend-css' href='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/css/frontend.min.css' type='text/css' media='all' />
<link rel='stylesheet' id='ppress-flatpickr-css' href='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.css' type='text/css' media='all' />
<link rel='stylesheet' id='ppress-select2-css' href='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.css' type='text/css' media='all' />
<link rel='stylesheet' id='grandnews-reset-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/reset.css' type='text/css' media='all' />
<link rel='stylesheet' id='grandnews-wordpress-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/wordpress.css' type='text/css' media='all' />
<link rel='stylesheet' id='grandnews-animation-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/animation.css' type='text/css' media='all' />
<link rel='stylesheet' id='ilightbox-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/ilightbox/ilightbox.css' type='text/css' media='all' />
<link rel='stylesheet' id='jquery-ui-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/jqueryui/custom.css' type='text/css' media='all' />
<link rel='stylesheet' id='flexslider-css' href='https://blog.lumen.com/wp-content/themes/grandnews/js/flexslider/flexslider.css' type='text/css' media='all' />
<link rel='stylesheet' id='tooltipster-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/tooltipster.css' type='text/css' media='all' />
<link rel='stylesheet' id='grandnews-screen-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/screen.css' type='text/css' media='all' />
<link rel='stylesheet' id='grandnews-custom-menu-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/menu/left-align.css' type='text/css' media='all' />
<link rel='stylesheet' id='fontawesome-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/font-awesome.min.css' type='text/css' media='all' />
<link rel='stylesheet' id='brightcove-pip-css-css' href='https://players.brightcove.net/videojs-pip/1/videojs-pip.css' type='text/css' media='all' />
<link rel='stylesheet' id='brightcove-playlist-css' href='https://blog.lumen.com/wp-content/plugins/brightcove-video-connect/assets/css/brightcove_playlist.min.css' type='text/css' media='all' />
<link rel='stylesheet' id='wp_review-style-css' href='https://blog.lumen.com/wp-content/plugins/wp-review/public/css/wp-review.css' type='text/css' media='all' />
<link rel='stylesheet' id='addtoany-css' href='https://blog.lumen.com/wp-content/plugins/add-to-any/addtoany.min.css' type='text/css' media='all' />
<link rel='stylesheet' id='kirki_google_fonts-css' href='https://fonts.googleapis.com/css?family=Roboto%3A800%2C700%2C700%2C800%2C400%2C900%2C700%2C100%2C100italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C700%2C700italic%2C900%2C900italic%7CRaleway%3A700%2C700%2C800%2C400%2C900%2C700%2C100%2C100italic%2C200%2C200italic%2C300%2C300italic%2Cregular%2Citalic%2C500%2C500italic%2C600%2C600italic%2C700%2C700italic%2C800%2C800italic%2C900%2C900italic&#038;subset' type='text/css' media='all' />
<link rel='stylesheet' id='kirki-styles-global-css' href='https://blog.lumen.com/wp-content/themes/grandnews/modules/kirki/assets/css/kirki-styles.css' type='text/css' media='all' />
<style id='kirki-styles-global-inline-css' type='text/css'>
body, input[type=text], input[type=email], input[type=url], input[type=password], textarea, input[type=tel]{font-family:Roboto, Helvetica, Arial, sans-serif;}body{font-size:18px;}h1, h2, h3, h4, h5, h6, h7, blockquote{font-family:Roboto, Helvetica, Arial, sans-serif;}h1, h2, h3, h4, h5, h6, h7{font-weight:800;}h1{font-size:34px;}h2{font-size:30px;}h3{font-size:26px;}h4{font-size:22px;}h5{font-size:14px;}h6{font-size:13px;}.header_cart_wrapper .cart_count, .post_img .post_icon_circle, .ppb_blog_half_content_slider .slides li .slider_image .post_icon_circle, #post_info_bar #post_indicator, .post_circle_thumb .post_number, .post_category_tag a, .post_category_tag span, .newsticker_label, .sk-cube-grid .sk-cube, .ppb_blog_video .one.div_wrapper .post_icon_circle, .ppb_blog_random .one_fifth_bg .content_link, .Grand_News_Category ul li .category_count, .ppb_blog_grid_with_posts .one_third.last .post_img .now_playing{background:#0075c9;}.read_next_wrapper:before, .read_next_wrapper .post_content .read_next_label, .social_share_counter_number{color:#0075c9;}ul.post_filter li a.selected{border-color:#0075c9;}body, #gallery_lightbox h2, .slider_wrapper .gallery_image_caption h2, .post_info a{color:#000000;}::selection{background-color:#000000;}a{color:#0075c9;}a:hover, a:active{color:#0075c9;}h1, h2, h3, h4, h5, pre, code, tt, blockquote, .post_header h5 a, .post_header h2 a, .post_header h3 a, .post_header.grid h6 a, .post_header.fullwidth h4 a, .post_header h5 a, .newsticker li a, blockquote, .site_loading_logo_item i, .subscribe_tagline, .post_info_author a, #post_info_bar #post_info_share, #post_info_bar #post_info_comment, .readmore, .post_info_comment a, .post_info_comment, .post_info_view, .woocommerce .woocommerce-ordering select, .woocommerce #page_content_wrapper a.button, .woocommerce.columns-4 ul.products li.product a.add_to_cart_button, .woocommerce.columns-4 ul.products li.product a.add_to_cart_button:hover, .ui-accordion .ui-accordion-header a, .tabs .ui-state-active a, body.woocommerce div.product .woocommerce-tabs ul.tabs li.active a, body.woocommerce-page div.product .woocommerce-tabs ul.tabs li.active a, body.woocommerce #content div.product .woocommerce-tabs ul.tabs li.active a, body.woocommerce-page #content div.product .woocommerce-tabs ul.tabs li.active a, .woocommerce div.product .woocommerce-tabs ul.tabs li a, .post_pagination a, .post_pagination a:hover, .post_pagination a:active, .post_related strong a, .pagination a, ul.post_filter li a, .read_next_wrapper .post_content .next_post_title h3 a, .author_social li a{color:#000000;}#social_share_wrapper, hr, #social_share_wrapper, .post.type-post, .comment .right, .widget_tag_cloud div a, .meta-tags a, .tag_cloud a, #footer, #post_more_wrapper, #page_content_wrapper .inner .sidebar_wrapper ul.sidebar_widget li.widget_nav_menu ul.menu li.current-menu-item a, .page_content_wrapper .inner .sidebar_wrapper ul.sidebar_widget li.widget_nav_menu ul.menu li.current-menu-item a, #autocomplete, #nav_wrapper, #page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle:before, .top_bar.scroll, .read_next_wrapper, #menu_wrapper .nav ul li.catmenu > .catmenu_wrapper, #menu_wrapper div .nav li.catmenu > .catmenu_wrapper, , .woocommerce ul.products li.product, .woocommerce-page ul.products li.product, .woocommerce ul.products li.product .price, .woocommerce-page ul.products li.product .price, #page_content_wrapper .inner .sidebar_content, #page_content_wrapper .inner .sidebar_content.left_sidebar, .ajax_close, .ajax_next, .ajax_prev, .portfolio_next, .portfolio_prev, .portfolio_next_prev_wrapper.video .portfolio_prev, .portfolio_next_prev_wrapper.video .portfolio_next, .separated, .blog_next_prev_wrapper, #post_more_wrapper h5, #ajax_portfolio_wrapper.hidding, #ajax_portfolio_wrapper.visible, .tabs.vertical .ui-tabs-panel, .woocommerce div.product .woocommerce-tabs ul.tabs li, .woocommerce #content div.product .woocommerce-tabs ul.tabs li, .woocommerce-page div.product .woocommerce-tabs ul.tabs li, .woocommerce-page #content div.product .woocommerce-tabs ul.tabs li, .woocommerce div.product .woocommerce-tabs .panel, .woocommerce-page div.product .woocommerce-tabs .panel, .woocommerce #content div.product .woocommerce-tabs .panel, .woocommerce-page #content div.product .woocommerce-tabs .panel, .woocommerce table.shop_table, .woocommerce-page table.shop_table, table tr td, .woocommerce .cart-collaterals .cart_totals, .woocommerce-page .cart-collaterals .cart_totals, .woocommerce .cart-collaterals .shipping_calculator, .woocommerce-page .cart-collaterals .shipping_calculator, .woocommerce .cart-collaterals .cart_totals tr td, .woocommerce .cart-collaterals .cart_totals tr th, .woocommerce-page .cart-collaterals .cart_totals tr td, .woocommerce-page .cart-collaterals .cart_totals tr th, table tr th, .woocommerce #payment, .woocommerce-page #payment, .woocommerce #payment ul.payment_methods li, .woocommerce-page #payment ul.payment_methods li, .woocommerce #payment div.form-row, .woocommerce-page #payment div.form-row, .ui-tabs li:first-child, .ui-tabs .ui-tabs-nav li, .ui-tabs.vertical .ui-tabs-nav li, .ui-tabs.vertical.right .ui-tabs-nav li.ui-state-active, .ui-tabs.vertical .ui-tabs-nav li:last-child, #page_content_wrapper .inner .sidebar_wrapper ul.sidebar_widget li.widget_nav_menu ul.menu li.current-menu-item a, .page_content_wrapper .inner .sidebar_wrapper ul.sidebar_widget li.widget_nav_menu ul.menu li.current-menu-item a, .pricing_wrapper, .pricing_wrapper li, .ui-accordion .ui-accordion-header, .ui-accordion .ui-accordion-content, #page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle:before, h2.widgettitle:before, #autocomplete, .ppb_blog_minimal .one_third_bg, #page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle, h2.widgettitle, h5.event_title, .tabs .ui-tabs-panel, .ui-tabs .ui-tabs-nav li, .ui-tabs li:first-child, .ui-tabs.vertical .ui-tabs-nav li:last-child, .woocommerce .woocommerce-ordering select, .woocommerce div.product .woocommerce-tabs ul.tabs li.active, .woocommerce-page div.product .woocommerce-tabs ul.tabs li.active, .woocommerce #content div.product .woocommerce-tabs ul.tabs li.active, .woocommerce-page #content div.product .woocommerce-tabs ul.tabs li.active, .woocommerce-page table.cart th, table.shop_table thead tr th, #page_caption, #nav_wrapper, .header_style_wrapper .top_bar{border-color:#eeeeee;}input[type=text], input[type=password], input[type=email], input[type=url], textarea, input[type=tel]{background-color:#ffffff;color:#111111;border-color:#e1e1e1;}input[type=text]:focus, input[type=password]:focus, input[type=email]:focus, input[type=url]:focus, textarea:focus, input[type=tel]:focus{border-color:#000000;}input[type=submit], input[type=button], a.button, .button, .woocommerce .page_slider a.button, a.button.fullwidth, .woocommerce-page div.product form.cart .button, .woocommerce #respond input#submit.alt, .woocommerce a.button.alt, .woocommerce button.button.alt, .woocommerce input.button.alt{font-family:Roboto, Helvetica, Arial, sans-serif;}input[type=submit], input[type=button], a.button, .button, .woocommerce .footer_bar .button, .woocommerce .footer_bar .button:hover, .woocommerce-page div.product form.cart .button, .woocommerce #respond input#submit.alt, .woocommerce a.button.alt, .woocommerce button.button.alt, .woocommerce input.button.alt{background-color:#0075c9;color:#ffffff;border-color:#0075c9;}.frame_top, .frame_bottom, .frame_left, .frame_right{background:#222222;}#menu_wrapper .nav ul li a, #menu_wrapper div .nav li > a{font-family:Raleway, Helvetica, Arial, sans-serif;font-size:14px;letter-spacing:0px;text-transform:none;}#menu_wrapper .nav ul li a, #menu_wrapper div .nav li > a, .mobile_main_nav li a, #sub_menu li a{font-weight:700;}#menu_wrapper .nav ul li a, #menu_wrapper div .nav li > a, .header_cart_wrapper a, #search_icon, #page_share{color:#111111;}#mobile_nav_icon{border-color:#111111;}#menu_wrapper .nav ul li a.hover, #menu_wrapper .nav ul li a:hover, #menu_wrapper div .nav li a.hover, #menu_wrapper div .nav li a:hover, #menu_wrapper div .nav > li.current-menu-item > a, #menu_wrapper div .nav > li.current-menu-parent > a, #menu_wrapper div .nav > li.current-menu-ancestor > a{color:#111111;}#menu_wrapper div .nav > li.current-menu-item > a, #menu_wrapper div .nav > li.current-menu-parent > a, #menu_wrapper div .nav > li.current-menu-ancestor > a{color:#111111;}.header_style_wrapper .top_bar, #nav_wrapper{border-color:#f5f5f7;}#nav_wrapper, body.left_align .top_bar{background-color:#ffffff;}#menu_wrapper .nav ul li ul li a, #menu_wrapper div .nav li ul li a, #menu_wrapper div .nav li.current-menu-parent ul li a{font-size:13px;font-weight:700;letter-spacing:0px;text-transform:none;color:#111111;}#menu_wrapper .nav ul li ul li a:hover, #menu_wrapper div .nav li ul li a:hover, #menu_wrapper div .nav li.current-menu-parent ul li a, #menu_wrapper div .nav li.current-menu-parent ul li a:hover, #menu_wrapper .nav ul li.megamenu ul li ul li a:hover, #menu_wrapper div .nav li.megamenu ul li ul li a:hover, #menu_wrapper .nav ul li.megamenu ul li ul li a:active, #menu_wrapper div .nav li.megamenu ul li ul li a:active{color:#222222;}#menu_wrapper .nav ul li ul li a:hover, #menu_wrapper div .nav li ul li a:hover, #menu_wrapper div .nav li.current-menu-parent ul li a:hover, #menu_wrapper .nav ul li.megamenu ul li ul li a:hover, #menu_wrapper div .nav li.megamenu ul li ul li a:hover, #menu_wrapper .nav ul li.megamenu ul li ul li a:active, #menu_wrapper div .nav li.megamenu ul li ul li a:active{background:#f5f5f7;}#menu_wrapper .nav ul li ul, #menu_wrapper div .nav li ul{background:#ffffff;}#menu_wrapper .nav ul li ul, #menu_wrapper div .nav li ul, #menu_wrapper .nav ul li ul li a, #menu_wrapper div .nav li ul li a, #menu_wrapper div .nav li.current-menu-parent ul li a{border-color:#f5f5f7;}#menu_wrapper div .nav li.megamenu ul li > a, #menu_wrapper div .nav li.megamenu ul li > a:hover, #menu_wrapper div .nav li.megamenu ul li > a:active{color:#222222;}#menu_wrapper div .nav li.megamenu ul li{border-color:#f5f5f7;}.above_top_bar{background:#0047bb;}.above_top_bar .today_time, #top_menu li a, .above_top_bar .social_wrapper ul li a, .above_top_bar .social_wrapper ul li a:hover, .above_top_bar .social_wrapper ul li a:active{color:#ffffff;}.mobile_menu_wrapper{background-color:#ffffff;}.mobile_main_nav li a, #sub_menu li a{font-family:Raleway, Helvetica, Arial, sans-serif;font-size:11px;text-transform:uppercase;letter-spacing:2px;}.mobile_main_nav li a, #sub_menu li a, .mobile_menu_wrapper .sidebar_wrapper a, .mobile_menu_wrapper .sidebar_wrapper, #close_mobile_menu i, .mobile_menu_wrapper .sidebar_wrapper h2.widgettitle{color:#444444;}#close_mobile_menu_button{background-color:#444444;}#page_caption, #page_caption h1 span{background-color:#ffffff;}#page_caption{padding-top:19px;padding-bottom:20px;}#page_caption h1{font-size:48px;}#page_caption h1, .post_caption h1{font-weight:800;text-transform:none;letter-spacing:0px;color:#0075c9;}#page_caption .page_title_wrapper, .page_title_wrapper{text-align:left;}#page_caption.hasbg{height:60vh;}.page_tagline{color:#0075c9;font-size:11px;font-weight:400;letter-spacing:2px;text-transform:none;}#page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle, h2.widgettitle, h5.widgettitle, .single_subtitle{font-family:Roboto, Helvetica, Arial, sans-serif;font-size:16px;font-weight:900;letter-spacing:0px;text-transform:none;}#page_content_wrapper .inner .sidebar_wrapper .sidebar .content, .page_content_wrapper .inner .sidebar_wrapper .sidebar .content{color:#000000;}#page_content_wrapper .inner .sidebar_wrapper a, .page_content_wrapper .inner .sidebar_wrapper a{color:#111111;}#page_content_wrapper .inner .sidebar_wrapper a:hover, #page_content_wrapper .inner .sidebar_wrapper a:active, .page_content_wrapper .inner .sidebar_wrapper a:hover, .page_content_wrapper .inner .sidebar_wrapper a:active{color:#0075c9;}#page_content_wrapper .sidebar .content .sidebar_widget li h2.widgettitle, h2.widgettitle, h5.widgettitle{color:#0075c9;}#footer_mailchimp_subscription{background-color:#f5f5f7;}.footer_bar{background-color:#f5f5f7;}#footer, #copyright{color:#000000;}#copyright a, #copyright a:active, #footer a, #footer a:active, #footer .sidebar_widget li h2.widgettitle{color:#000000;}#copyright a:hover, #footer a:hover, .social_wrapper ul li a:hover{color:#000000;}.footer_bar_wrapper, .footer_bar{border-color:#333333;}#footer .widget_tag_cloud div a{background:#333333;}.footer_bar_wrapper .social_wrapper ul li a{color:#000000;}#page_content_wrapper .inner .sidebar_content.full_width.blog_f, body.single-post #page_content_wrapper .inner .sidebar_content.full_width{width:90%;}.post_header:not(.single) h5, body.single-post .post_header_title h1, #post_featured_slider li .slider_image .slide_post h2, #autocomplete li strong, .post_related strong, #footer ul.sidebar_widget .posts.blog li a, #post_info_bar .post_info .post_info_title, .post_header h2, .newsticker li a, .ppb_blog_fullwidth_slider ul.slides li .slider_image .slider_post_title h2, #menu_wrapper div .nav li.catmenu2 > .catmenu_wrapper .one_third h6, .catmenu_wrapper .one_fifth h6, #autocomplete a h6, #page_content_wrapper .posts.blog li a, .page_content_wrapper .posts.blog li a, #menu_wrapper div .nav li.catmenu2 > .catmenu_wrapper a.post_title{font-family:Roboto, Helvetica, Arial, sans-serif;text-transform:capitalize;font-weight:700;letter-spacing:0px;}
</style>
<link rel='stylesheet' id='grandnews-script-responsive-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/grid.css' type='text/css' media='all' />
<link rel='stylesheet' id='grandnews-custom-menu-responsive-css-css' href='https://blog.lumen.com/wp-content/themes/grandnews/css/menu/left-align-grid.css' type='text/css' media='all' />
<link rel='stylesheet' id='grandnews-script-custom-css-css' href='https://blog.lumen.com/wp-admin/admin-ajax.php?action=grandnews_custom_css' type='text/css' media='all' />
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/google-analytics-for-wordpress/assets/js/frontend-gtag.min.js' id='monsterinsights-frontend-script-js'></script>
<script data-cfasync="false" data-wpfc-render="false" type="text/javascript" id='monsterinsights-frontend-script-js-extra'>/* <![CDATA[ */
var monsterinsights_frontend = {"js_events_tracking":"true","download_extensions":"doc,pdf,ppt,zip,xls,docx,pptx,xlsx","inbound_paths":"[{\"path\":\"\\\/go\\\/\",\"label\":\"affiliate\"},{\"path\":\"\\\/recommend\\\/\",\"label\":\"affiliate\"}]","home_url":"https:\/\/blog.lumen.com","hash_tracking":"false","ua":"UA-41153014-24","v4_id":""};/* ]]> */
</script>
<script type='text/javascript' id='addtoany-core-js-before'>
window.a2a_config=window.a2a_config||{};a2a_config.callbacks=[];a2a_config.overlays=[];a2a_config.templates={};
</script>
<script type='text/javascript' async src='https://static.addtoany.com/menu/page.js' id='addtoany-core-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/jquery/jquery.min.js' id='jquery-core-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/jquery/jquery-migrate.min.js' id='jquery-migrate-js'></script>
<script type='text/javascript' async src='https://blog.lumen.com/wp-content/plugins/add-to-any/addtoany.min.js' id='addtoany-jquery-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/flatpickr/flatpickr.min.js' id='ppress-flatpickr-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/select2/select2.min.js' id='ppress-select2-js'></script>
<link rel="https://api.w.org/" href="https://blog.lumen.com/wp-json/" /><link rel="alternate" type="application/json" href="https://blog.lumen.com/wp-json/wp/v2/posts/15534" /><link rel="EditURI" type="application/rsd+xml" title="RSD" href="https://blog.lumen.com/xmlrpc.php?rsd" />
<link rel="wlwmanifest" type="application/wlwmanifest+xml" href="https://blog.lumen.com/wp-includes/wlwmanifest.xml" />
<meta name="generator" content="WordPress 6.2.2" />
<link rel='shortlink' href='https://blog.lumen.com/?p=15534' />
<link rel="alternate" type="application/json+oembed" href="https://blog.lumen.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F" />
<link rel="alternate" type="text/xml+oembed" href="https://blog.lumen.com/wp-json/oembed/1.0/embed?url=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F&#038;format=xml" />
<meta name="generator" content="Site Kit by Google 1.99.0" />		<style>
			
		div#onetrust-consent-sdk #onetrust-banner-sdk
		{
			background-color: #f2f2f2;
			border: #DDD solid 1px;
		}

		div#onetrust-consent-sdk #onetrust-pc-btn-handler.cookie-setting-link
		{
			color: #FFF;
			background-color: #666;
			text-decoration: none;
		}


		div#onetrust-consent-sdk #onetrust-pc-sdk, div#onetrust-consent-sdk #search-container, div#onetrust-consent-sdk #onetrust-pc-sdk .ot-switch.toggle, div#onetrust-consent-sdk #onetrust-pc-sdk .group-toggle .checkbox, div#onetrust-consent-sdk #onetrust-pc-sdk #pc-title:after
		{
			background-color: #fdfdfd;
		}

		div#onetrust-pc-sdk .host-option-group .vendor-host
		{
			border: #DDD solid 1px;
		}

		</style>
		<!-- OneTrust Cookies Consent Notice start -->
		<script src="https://cdn.cookielaw.org/scripttemplates/otSDKStub.js"  type="text/javascript" charset="UTF-8" data-domain-script="e733a0d8-63ff-4a39-b870-9ef50b603bcf"></script>
		<script type="text/javascript">
			function OptanonWrapper() { }
		</script>
		<!-- OneTrust Cookies Consent Notice end -->
		
<!-- Google Tag Manager snippet added by Site Kit -->
<script type="text/javascript">
			( function( w, d, s, l, i ) {
				w[l] = w[l] || [];
				w[l].push( {'gtm.start': new Date().getTime(), event: 'gtm.js'} );
				var f = d.getElementsByTagName( s )[0],
					j = d.createElement( s ), dl = l != 'dataLayer' ? '&l=' + l : '';
				j.async = true;
				j.src = 'https://www.googletagmanager.com/gtm.js?id=' + i + dl;
				f.parentNode.insertBefore( j, f );
			} )( window, document, 'script', 'dataLayer', 'GTM-TLWF636' );
			
</script>

<!-- End Google Tag Manager snippet added by Site Kit -->
<link rel="icon" href="https://blog.lumen.com/wp-content/uploads/2020/09/favicon.png" sizes="32x32" />
<link rel="icon" href="https://blog.lumen.com/wp-content/uploads/2020/09/favicon.png" sizes="192x192" />
<link rel="apple-touch-icon" href="https://blog.lumen.com/wp-content/uploads/2020/09/favicon.png" />
<meta name="msapplication-TileImage" content="https://blog.lumen.com/wp-content/uploads/2020/09/favicon.png" />
		<style type="text/css" id="wp-custom-css">
			#field_1_1 input::placeholder{
	font-style: normal
}

#field_1_1 input{
text-align:center
}
.ppb_blog_fullwidth_slider .flex-direction-nav a {
    opacity: 1
}

#wrapper{
	padding-top: 163px;
}

.ppb_wrapper .withsmallpadding p {
    padding: 0;
}
.ppb_wrapper .withsmallpadding p img {
    float: left;
    width: 100%;
}
.ppb_blog_fullwidth_slider .standard_wrapper {
    background: rgba(0, 0, 0, .3);
    padding: 20px;
}
.home
.ppb_blog_filterable_3cols.one.nopadding {
 background: #F9F9FA !important;
}

.single_subtitle {
	color: #0075C9 !important;
}
.home .ppb_blog_filterable_3cols.one.nopadding .single_subtitle {
    color: #000 !important;
}
#searchform .post_attribute {
   display: none;
}
.flex-direction-nav a:before {
	    font-size: 24px;
	    color: #FF9E18;
			font-weight: bolder;
}
.flex-direction-nav a {
	    border: 3px solid #FF9E18;
}
.fa-bolt:before {
   display: none;
}
.post_info_date {
	color: #BEBEBE !important;
	text-transform: capitalize;
}
.post_info_date a{
	color: #BEBEBE !important;
	text-transform: capitalize;
}
input[type=submit], input[type=button], a.button, .button {
	text-transform: capitalize;
}
.social_share_button_wrapper ul li a.google_share {
   display: none;
}
ul.post_filter li a {
	text-transform: capitalize;
	font-size: 16px;
	font-weight: 500;
}
.newsticker_label {
	text-transform: capitalize;
}
.post_category_tag a, .post_category_tag span {
	text-transform: capitalize;
}
#about_the_author {
	background: #EEEEEE;
}
.newsticker_nav a, .carousel_nav a {
	    border: 2px solid #0075C9;
			opacity: 1;
}
.newsticker_nav a:before, .carousel_nav a:before {
	color: #0075C9;
}
@media only screen and (max-width: 768px) {
p {
font-size: 16px;
}
}
@media only screen and (max-width: 320px)  {
p {
font-size: 16px;
}
}
@media only screen and (max-width: 960px)  {
p {
font-size: 16px;
}
}
.social_share_button_wrapper {
   display: none;
}
.social_share_counter {
   display: none;
}
#footer_menu {
   display: none;
}
#footer .sidebar_widget li h2.widgettitle {
    margin-bottom: 25px;
    color: #000;
    text-align: center;
}
.post_info_comment {
   display: none;
}
.tg_social_icons {
    color: #0075C9;
}		</style>
		<script src="//assets.adobedtm.com/c58e7dfcc1ae/65c3c535dbf4/launch-22e49494a283.min.js" async></script>
</head>

<body class="post-template-default single single-post postid-15534 single-format-standard left_align">

		<input type="hidden" id="pp_enable_right_click" name="pp_enable_right_click" value=""/>
	<input type="hidden" id="pp_enable_dragging" name="pp_enable_dragging" value=""/>
	<input type="hidden" id="pp_image_path" name="pp_image_path" value="https://blog.lumen.com/wp-content/themes/grandnews/images/"/>
	<input type="hidden" id="pp_homepage_url" name="pp_homepage_url" value="https://blog.lumen.com/"/>
	<input type="hidden" id="pp_ajax_search" name="pp_ajax_search" value="1"/>
	<input type="hidden" id="pp_fixed_menu" name="pp_fixed_menu" value="1"/>
	<input type="hidden" id="tg_sidebar_sticky" name="tg_sidebar_sticky" value="1"/>
	<input type="hidden" id="pp_topbar" name="pp_topbar" value=""/>
	<input type="hidden" id="pp_page_title_img_blur" name="pp_page_title_img_blur" value="1"/>
	<input type="hidden" id="tg_blog_slider_layout" name="tg_blog_slider_layout" value=""/>
	<input type="hidden" id="pp_back" name="pp_back" value="Back"/>
	<input type="hidden" id="tg_lightbox_skin" name="tg_lightbox_skin" value="metro-black"/>
	<input type="hidden" id="tg_lightbox_thumbnails" name="tg_lightbox_thumbnails" value="horizontal"/>
	<input type="hidden" id="tg_lightbox_opacity" name="tg_lightbox_opacity" value="0.95"/>
	<input type="hidden" id="tg_enable_lazy" name="tg_enable_lazy" value=""/>
	
		<input type="hidden" id="pp_footer_style" name="pp_footer_style" value="2"/>
	
	<!-- Begin mobile menu -->
	<a id="close_mobile_menu" href="javascript:;"></a>
	<div class="mobile_menu_wrapper">
		<a id="close_mobile_menu_button" href="javascript:;"><i class="fa fa-close"></i></a>
	
	    <div class="menu-main-menu-container"><ul id="mobile_main_menu" class="mobile_main_nav"><li id="menu-item-4996" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-4996"><a href="https://blog.lumen.com/technologies/">Technologies</a>
<ul class="sub-menu">
	<li id="menu-item-6828" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-6828"><a href="https://blog.lumen.com/black-lotus-labs/">Black Lotus Labs</a></li>
	<li id="menu-item-4942" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4942"><a href="https://blog.lumen.com/technologies/cloud/">Cloud</a></li>
	<li id="menu-item-11229" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11229"><a href="https://blog.lumen.com/technologies/edge-compute/">Edge Compute</a></li>
	<li id="menu-item-5014" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5014"><a href="https://blog.lumen.com/technologies/collaboration/">Collaboration</a></li>
	<li id="menu-item-5027" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5027"><a href="https://blog.lumen.com/technologies/managed-services/">Managed Services</a></li>
	<li id="menu-item-5036" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5036"><a href="https://blog.lumen.com/technologies/network/">Network</a></li>
	<li id="menu-item-4963" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4963"><a href="https://blog.lumen.com/technologies/security/">Security</a></li>
</ul>
</li>
<li id="menu-item-5039" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5039"><a href="https://blog.lumen.com/business-advice/">Business Advice</a>
<ul class="sub-menu">
	<li id="menu-item-5092" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5092"><a href="https://blog.lumen.com/business-advice/business-continuity-disaster-recovery/">Business Continuity &#038; Disaster Recovery</a></li>
	<li id="menu-item-5063" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5063"><a href="https://blog.lumen.com/business-advice/customer-experience/">Customer Experience</a></li>
	<li id="menu-item-5061" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5061"><a href="https://blog.lumen.com/business-advice/data-driven-business/">Data Driven Business</a></li>
	<li id="menu-item-4882" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4882"><a href="https://blog.lumen.com/business-advice/operational-efficiency/">Operational Efficiency</a></li>
	<li id="menu-item-5049" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5049"><a href="https://blog.lumen.com/business-advice/tech-trends/">Tech Trends</a></li>
</ul>
</li>
<li id="menu-item-5183" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-5183"><a href="https://blog.lumen.com/industries/">Industries</a>
<ul class="sub-menu">
	<li id="menu-item-5100" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5100"><a href="https://blog.lumen.com/industries/financial-services/">Financial Services</a></li>
	<li id="menu-item-5120" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5120"><a href="https://blog.lumen.com/industries/healthcare/">Healthcare</a></li>
	<li id="menu-item-8761" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-8761"><a href="https://blog.lumen.com/industries/gaming/">Gaming</a></li>
	<li id="menu-item-5137" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5137"><a href="https://blog.lumen.com/industries/manufacturing/">Manufacturing</a></li>
	<li id="menu-item-5147" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5147"><a href="https://blog.lumen.com/industries/media-and-entertainment/">Media and Entertainment</a></li>
	<li id="menu-item-8806" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-8806"><a href="https://blog.lumen.com/industries/pharmaceutical/">Pharmaceutical</a></li>
	<li id="menu-item-5162" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5162"><a href="https://blog.lumen.com/industries/public-sector/">Public Sector</a></li>
	<li id="menu-item-5177" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5177"><a href="https://blog.lumen.com/industries/retail/">Retail</a></li>
	<li id="menu-item-11816" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11816"><a href="https://blog.lumen.com/industries/technology/">Technology</a></li>
</ul>
</li>
<li id="menu-item-6838" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children menu-item-6838"><a href="https://blog.lumen.com/about-lumen/">About Us</a>
<ul class="sub-menu">
	<li id="menu-item-6851" class="menu-item menu-item-type-post_type menu-item-object-page menu-item-6851"><a href="https://blog.lumen.com/leadership-perspectives/">Leadership Perspectives</a></li>
	<li id="menu-item-4743" class="menu-item menu-item-type-custom menu-item-object-custom menu-item-4743"><a target="_blank" rel="noopener" href="https://news.lumen.com">NewsRoom</a></li>
</ul>
</li>
</ul></div>		
		<!-- Begin side menu sidebar -->
		<div class="page_content_wrapper">
			<div class="sidebar_wrapper">
		        <div class="sidebar">
		        
		        	<div class="content">
		        
		        		<ul class="sidebar_widget">
		        				        		</ul>
		        	
		        	</div>
		    
		        </div>
			</div>
		</div>
		<!-- End side menu sidebar -->
	</div>
	<!-- End mobile menu -->

	<!-- Begin template wrapper -->
	<div id="wrapper">
	
	
<div class="header_style_wrapper">



<div class="top_bar">
    
    <div class="standard_wrapper">
    
	    <!-- Begin logo -->
	    <div id="logo_wrapper">
	    
	    	    <div id="logo_normal" class="logo_container">
	        <div class="logo_align">
		        <a id="custom_logo" class="logo_wrapper default" href="https://blog.lumen.com/">
		        			    		<img src="https://blog.lumen.com/wp-content/uploads/2020/09/Lumen-Logo.png" alt="" width="215" height="64"/>
		    				        </a>
	        </div>
	    </div>
	    	    <!-- End logo -->
	    
	    
	    <div id="menu_wrapper">
	    
	    <!-- Begin right corner buttons -->
		<div id="logo_right_button">
		    <!-- div class="post_share_wrapper">
		    	<a id="page_share" href="javascript:;"><i class="fa fa-share-alt"></i></a>
		    </div -->
		    
		    		    
		    <!-- Begin search icon -->
		    <a href="javascript:;" id="search_icon"><i class="fa fa-search"></i></a>
		    <!-- End side menu -->
		
		    <!-- Begin search icon -->
		    <a href="javascript:;" id="mobile_nav_icon"></a>
		    <!-- End side menu -->
		    
		</div>
		<!-- End right corner buttons -->
	    
			      <div id="nav_wrapper">
	      	<div class="nav_wrapper_inner">
	      		<div id="menu_border_wrapper">
	      			<div class="menu-main-menu-container"><ul id="main_menu" class="nav"><li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children arrow menu-item-4996"><a href="https://blog.lumen.com/technologies/">Technologies</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-6828"><a href="https://blog.lumen.com/black-lotus-labs/">Black Lotus Labs</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4942"><a href="https://blog.lumen.com/technologies/cloud/">Cloud</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11229"><a href="https://blog.lumen.com/technologies/edge-compute/">Edge Compute</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5014"><a href="https://blog.lumen.com/technologies/collaboration/">Collaboration</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5027"><a href="https://blog.lumen.com/technologies/managed-services/">Managed Services</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5036"><a href="https://blog.lumen.com/technologies/network/">Network</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4963"><a href="https://blog.lumen.com/technologies/security/">Security</a></li>
</ul>
</li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children arrow menu-item-5039"><a href="https://blog.lumen.com/business-advice/">Business Advice</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5092"><a href="https://blog.lumen.com/business-advice/business-continuity-disaster-recovery/">Business Continuity &#038; Disaster Recovery</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5063"><a href="https://blog.lumen.com/business-advice/customer-experience/">Customer Experience</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5061"><a href="https://blog.lumen.com/business-advice/data-driven-business/">Data Driven Business</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-4882"><a href="https://blog.lumen.com/business-advice/operational-efficiency/">Operational Efficiency</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5049"><a href="https://blog.lumen.com/business-advice/tech-trends/">Tech Trends</a></li>
</ul>
</li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children arrow menu-item-5183"><a href="https://blog.lumen.com/industries/">Industries</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5100"><a href="https://blog.lumen.com/industries/financial-services/">Financial Services</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5120"><a href="https://blog.lumen.com/industries/healthcare/">Healthcare</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-8761"><a href="https://blog.lumen.com/industries/gaming/">Gaming</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5137"><a href="https://blog.lumen.com/industries/manufacturing/">Manufacturing</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5147"><a href="https://blog.lumen.com/industries/media-and-entertainment/">Media and Entertainment</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-8806"><a href="https://blog.lumen.com/industries/pharmaceutical/">Pharmaceutical</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5162"><a href="https://blog.lumen.com/industries/public-sector/">Public Sector</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-5177"><a href="https://blog.lumen.com/industries/retail/">Retail</a></li>
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-11816"><a href="https://blog.lumen.com/industries/technology/">Technology</a></li>
</ul>
</li>
<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-has-children arrow menu-item-6838"><a href="https://blog.lumen.com/about-lumen/">About Us</a>
<ul class="sub-menu">
	<li class="menu-item menu-item-type-post_type menu-item-object-page menu-item-6851"><a href="https://blog.lumen.com/leadership-perspectives/">Leadership Perspectives</a></li>
	<li class="menu-item menu-item-type-custom menu-item-object-custom menu-item-4743"><a target="_blank" rel="noopener" href="https://news.lumen.com">NewsRoom</a></li>
</ul>
</li>
</ul></div>	      		</div>
	      	</div>
	      </div>
	      <!-- End main nav -->
	  	  
  	</div>
</div>
</div>
</div>
</div>



<!-- Begin content -->
<div id="page_content_wrapper" class="">
<div class="inner">

	<!-- Begin main content -->
	<div class="inner_wrapper">

		<div class="sidebar_content">
					
						
<!-- Begin each blog post -->
<div id="post-15534" class="post-15534 post type-post status-publish format-standard has-post-thumbnail hentry category-about-lumen category-black-lotus-labs category-industries category-technology tag-black-lotus-labs tag-malware tag-router">

	<div class="post_wrapper">
	    
	    <div class="post_content_wrapper">
	    
	    		    
	    	<div class="post_header">
				<div class="post_header_title">
				 	<div class="post_info_cat">
				 						 	</div>
				   	<h1>Routers from the Underground: Exposing AVrecon</h1>
				   	<div class="post_detail post_date">
			      		<span class="post_info_author">
			      						      			<a href="https://blog.lumen.com/author/black-lotus-labs/"><span class="gravatar"><img data-del="avatar" src='https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-65x65.png' class='avatar pp-user-avatar avatar-60 photo ' height='60' width='60'/></span>Black Lotus Labs</a>
			      		</span>
			      		<span class="post_info_date">
			      			Posted On July 12, 2023			      		</span>
				  	</div>
				  	<div class="post_detail post_comment">
				  		<div class="post_info_comment">
							<a href="https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/#respond"><i class="fa fa-commenting"></i>0</a>
						</div>
						
										  	</div>
				</div>
			</div>
			
			<hr class="post_divider"/><br class="clear"/>
			
						
			<div class="social_share_counter">
	<div class="social_share_counter_number">0</div>
	<div class="social_share_counter_label">Shares</div>
</div>
<div class="social_share_button_wrapper">
	<ul>
		<li><a class="tooltip facebook_share" title="Share On Facebook" target="_blank" href="https://www.facebook.com/sharer/sharer.php?u=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"><i class="fa fa-facebook"></i>Share On Facebook</a></li>
		<li><a class="tooltip twitter_share" title="Share On Twitter" target="_blank" href="https://twitter.com/intent/tweet?original_referer=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/&text=Routers from the Underground: Exposing AVrecon&url=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"><i class="fa fa-twitter"></i>Tweet It</a></li>
		<li><a class="tooltip pinterest_share" title="Share On Pinterest" target="_blank" href="http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F&media=https%3A%2F%2Fblog.lumen.com%2Fwp-content%2Fuploads%2F2023%2F07%2FAVrecon.jpg"><i class="fa fa-pinterest"></i></a></li>
		<li><a class="tooltip google_share" title="Share On Google+" target="_blank" href="https://plus.google.com/share?url=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"><i class="fa fa-google-plus"></i></a></li>
		<li><a class="tooltip email_share" title="Share by Email" href="mailto:?Subject=Routers+from+the+Underground%3A+Exposing+AVrecon&amp;Body=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F"><i class="fa fa-envelope"></i></a></li>
	</ul>
</div>
<Br class="clear"/>	    
	    				
			    	    <div class="post_img static">
			    	    	<img src="https://blog.lumen.com/wp-content/uploads/2023/07/AVrecon.jpg" alt="Computer code shown on blue background" class="" style="width:848px;height:563px;"/>
			    	    </div>
			
			
		    <div class="post_header single">
				
				<div class="addtoany_share_save_container addtoany_content addtoany_content_top"><div class="a2a_kit a2a_kit_size_32 addtoany_list" data-a2a-url="https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/" data-a2a-title="Routers from the Underground: Exposing AVrecon"><a class="a2a_button_facebook" href="https://www.addtoany.com/add_to/facebook?linkurl=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F&amp;linkname=Routers%20from%20the%20Underground%3A%20Exposing%20AVrecon" title="Facebook" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_twitter" href="https://www.addtoany.com/add_to/twitter?linkurl=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F&amp;linkname=Routers%20from%20the%20Underground%3A%20Exposing%20AVrecon" title="Twitter" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_linkedin" href="https://www.addtoany.com/add_to/linkedin?linkurl=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F&amp;linkname=Routers%20from%20the%20Underground%3A%20Exposing%20AVrecon" title="LinkedIn" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_pinterest" href="https://www.addtoany.com/add_to/pinterest?linkurl=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F&amp;linkname=Routers%20from%20the%20Underground%3A%20Exposing%20AVrecon" title="Pinterest" rel="nofollow noopener" target="_blank"></a><a class="a2a_button_email" href="https://www.addtoany.com/add_to/email?linkurl=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F&amp;linkname=Routers%20from%20the%20Underground%3A%20Exposing%20AVrecon" title="Email" rel="nofollow noopener" target="_blank"></a><a class="a2a_dd addtoany_share_save addtoany_share" href="https://www.addtoany.com/share"></a></div></div><h2>Executive Summary</h2>
<p>Lumen Black Lotus Labs<sup>®</sup> identified another multi-year campaign involving compromised routers across the globe. This is a complex operation that infects small-office/home-office (SOHO) routers, deploying a Linux-based Remote Access Trojan (RAT) we’ve dubbed “AVrecon.” Apart from a single reference to AVrecon in May 2021, the malware has been operating undetected for more than two years. Black Lotus labs performed an extensive analysis documenting the malware functionality, its size, and how it fits into the cybercrime ecosystem.</p>
<p>We assess the purpose of the campaign appears to be the creation of a covert network to quietly enable a range of criminal activities from password spraying to digital advertising fraud. Due to the surreptitious nature of the malware, owners of infected machines rarely notice any service disruption or loss of bandwidth. This assessment is based on observed telemetry and the analysis of functionality in the binary that allows the actor to interact with a remote shell and deploy subsequent binaries. Using Lumen’s global network visibility, Black Lotus Labs has determined the composition of a network that has infiltrated more than 70,000 machines, gaining a persistent hold in more than 40,000 IPs in more than 20 countries. The use of encryption prevents us from commenting on the results of successful password spraying attempts; however, we have null-routed the command and control (C2) nodes and impeded traffic through the proxy servers, which rendered the botnet inert across the Lumen backbone.</p>
<h2>Introduction</h2>
<p>Black Louts Labs has tracked the abuse of networking equipment in various campaigns from <a href="https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/" target="_blank" rel="noopener">nation-state</a> to <a href="https://blog.lumen.com/new-mozi-malware-family-quietly-amasses-iot-bots/" target="_blank" rel="noopener">cybercrime</a> and even <a href="https://blog.lumen.com/hacktivist-campaign-spreads-manifesto-through-router-configuration-files/" target="_blank" rel="noopener">hacktivism</a>. On June 13, 2023, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) <a href="https://www.cisa.gov/news-events/directives/binding-operational-directive-23-02" target="_blank" rel="noopener">warned</a> that exploitation of networking devices such as SOHO routers can enable adversaries to stand up actor-controlled infrastructure globally or gain unrestricted access to organizational networks. This is a serious threat because these devices typically live outside the traditional security perimeter, which significantly decreases the ability to detect malicious activity.</p>
<p>In our latest investigation, Black Lotus Labs discovered one of the largest botnets targeting small-office/home-office (SOHO) routers seen in recent history. It has been used to create residential proxy services to shroud malicious activity such as password spraying, web-traffic proxying and ad fraud. Surpassing <a href="https://blog.lumen.com/qakbot-retool-reinfect-recycle/" target="_blank" rel="noopener">Qakbot</a> in scale, AVrecon operated undetected for more than two years. While there were references on Twitter in May 2021 by <a href="https://twitter.com/sethkinghi/status/1397814848549900288?s=61&amp;t=CjdSCT0_DYwhwYNRQvLFiQ" target="_blank" rel="noopener">@SethKingHi</a>, no other research showed the breadth of this operation or thoroughly documented its functionality.</p>
<p>Upon infection, the threat actor enumerates the victim’s SOHO router, then sends that information back to the embedded C2 domain. From there, the infected system is ordered to begin interacting with a separate set of servers, which we refer to as second stage C2 servers. Using both Lumen’s proprietary and commercial telemetry, we discovered 15 unique second stage C2s. Based on information associated with their x.509 certificates, we assess that some of these second stage C2s have been active since at least October 2021. We took a 28-day snapshot of the second stage servers and found more than 70,000 distinct IP addresses communicating with them. We then investigated how many machines were persistently infected – meaning they communicated with one of the second stage servers for two or more days within the 28-day window – and we identified 41,000 nodes.</p>
<p>We have seen a number of SOHO-based botnets like <a href="https://blog.lumen.com/chaos-is-a-go-based-swiss-army-knife-of-malware/" target="_blank" rel="noopener">Chaos</a> leverage their access for more aggressive activity like deploying crypto-miners or launching DDoS attacks. These activities tend to draw attention, as mining creates performance issues from overworked CPUs, and DDoS often results in abuse complaints. The AVrecon campaign found success because:</p>
<ol>
<li>The target machines are primarily networking equipment that do not offer standard endpoint detection and response (EDR) solutions.</li>
<li>We suspect the threat actor focused on the type of SOHO devices users would be less likely to patch against common vulnerabilities and exposures (CVEs). Instead of using this botnet for a quick payout, the operators maintained a more temperate approach and were able to operate undetected for more than two years.</li>
</ol>
<p>While there were two brief <a href="https://twitter.com/SethKingHi/status/1397814848549900288" target="_blank" rel="noopener">references</a> to this <a href="https://raw.githubusercontent.com/stamparm/maltrail/master/trails/static/malware/avrecon.txt" target="_blank" rel="noopener">malware family</a> in 2021, there has not been a comprehensive write-up covering the extent of its operations. This report describes the malware functionality and embedded capabilities, examining how the remote access trojan interacts with the various C2 servers. Finally, we explore the scope of the botnet’s spread and the activity stemming from it.</p>
<p style="text-align: center;"><img decoding="async" class="size-full wp-image-15540 aligncenter" src="http://blog.lumen.com/wp-content/uploads/2023/07/Figure1.jpg" alt="AVrecon campaign flow" width="404" height="276" /><span style="font-size: 10pt;">Figure 1: AVrecon campaign</span></p>
<h2>Malware Analysis</h2>
<p>The Black Lotus Labs team’s analysis revealed that AVrecon was written in C and targeted ARM-embedded devices. The choice of that programming language allows for portability, and, later in our investigation, we discovered that the malware had been compiled for different architectures.</p>
<p>Once the AVrecon RAT is deployed on the infected system, its actions can generally be placed into three categories:</p>
<ul>
<li>It checks to see if other instances of the malware are already running on the system.</li>
<li>It gathers host-based information.</li>
<li>It builds the parameters of the C2 channel.</li>
</ul>
<h4>Checking for other instances</h4>
<p>First, the malware checks for any instances of itself on the host machine by searching for existing processes on port 48102 and opening a listener on that port. If the bind is successful, it writes the process ID to the file <em>jid.pid</em> in the <em>tmp</em> directory. If there is already a service running on port 48102, the malware kills any existing processes that don’t match the current process ID, then moves on to kill any process bound to port 48102. We have not seen the malware utilize any other ports on compromised machines during installation. In an interesting final act, should none of the previous attempts succeed, AVrecon has instructions to delete itself entirely from the host machine.</p>
<h4>Gathering host-based information</h4>
<p>AVrecon proceeds to collect host-based information about the machine, including the device <em>uname</em> (kernel information), CPU, memory usage, <em>bin</em> path where it’s running, and <em>hostname</em>. When it has obtained what it needs, pre-built functions spawn a remote shell to execute commands, download subsequent binaries, and configure a proxy. The full list is shown by command number:</p>
<p><img decoding="async" loading="lazy" class="size-full wp-image-15560 aligncenter" src="http://blog.lumen.com/wp-content/uploads/2023/07/Table-1-commands-list-AVrecon.png" alt="Commands list for AVrecon" width="728" height="356" /></p>
<h4>Building C2 parameters</h4>
<p>With freedom to move on the infected system, the malware begins constructing the C2 parameters. While the malware is shipped with an embedded configuration for C2 communications, it first checks to see if a configuration already exists on the infected host from prior communications and, if not, uses parameters for the C2 sent in the malware’s configuration. To check if C2 configurations exist, the binary searches for legitimate files named either <em>nvram</em> or <em>xmldbc</em> in the <em>bin</em> and <em>sbin</em> directories. It then searches for variables previously configured by the malware in those files &#8212; memasik, domik, urlik and portik. If either of these programs is found with the set variables, the binary extracts the encrypted C2 components from <em>memasik</em>, <em>domik</em>, <em>urlik</em>, and <em>portik</em> variables, including session cookies from any previous session, domain, URL and port information. If any of the four variables are not found, the malware attempts to read and decrypt configuration from <em>/tmp/dnssmasq.pid</em>. Finally, if that fails, it decrypts the hardcoded domain, URL and port from the embedded C2 configuration.</p>
<h2>Network-based Communications</h2>
<p>The binary proceeds with a GET request to the C2 using the configuration extracted in the previous process. The GET request contains various headers with encrypted details about the infected machine. The GET URL and host field are listed below, along with a sample of the decrypted information being sent to the C2.</p>
<h4>Sample Initial C2 Beacon</h4>
<p>GET /lumi/track.php?pet=maral&amp;age=1&amp;up=1112 HTTP/1.1<br />
Host: utcp[.]cc</p>
<p><img decoding="async" loading="lazy" class="size-full wp-image-15561 aligncenter" src="http://blog.lumen.com/wp-content/uploads/2023/07/Table-2-C2-beacon-AVrecon.png" alt="C2 beacon AVrecon" width="720" height="389" /></p>
<p>The response from the C2 is a series of commands from the list above and decrypted parameters. A sample is below. To illustrate the functionality, in the second response parameter, the command is #1 with an encrypted parameter of 757A6D7E336D6D which decrypts to utcp[.]cc. This indicates the malware should update to the C2 to utcp[.]cc.</p>
<h4>Initial C2 Response</h4>
<p><img decoding="async" loading="lazy" class="size-full wp-image-15562 aligncenter" src="http://blog.lumen.com/wp-content/uploads/2023/07/Table-3-C2-response-AVrecon.png" alt="C2 response AVrecon" width="729" height="174" /></p>
<p>Using these new configuration parameters, the malware reaches out to the configured C2. When the malware connects to this URL, a response containing information about an additional C2 is returned, intended to direct future responses.</p>
<h4>Response from /lumi/ping.php</h4>
<p><img decoding="async" loading="lazy" class="size-full wp-image-15563 aligncenter" src="http://blog.lumen.com/wp-content/uploads/2023/07/Table-4-Ping-response-AVrecon.png" alt=" Ping response AVrecon" width="720" height="362" /></p>
<p>Once the agent receives a command to communicate with the next C2 over port 8000, it immediately checks in with that C2 and enters a loop where it sends the word “ping” and awaits the response “pong.” It repeats this loop until it either expires or receives subsequent tasking from the new second-stage C2.</p>
<p style="text-align: center;"><img decoding="async" loading="lazy" class="size-full wp-image-15541 aligncenter" src="http://blog.lumen.com/wp-content/uploads/2023/07/Figure2.jpg" alt="PING/PONG traffic code" width="624" height="306" /><span style="font-size: 10pt;">Figure 2: Example of the PING/PONG traffic</span></p>
<p>Based off one example, we observed the agent get redirected to another server and told to communicate over port 5178. Some of the C2s that were supplied by the second stage C2 server include 148.72.155[.]112, 148.72.155[.]189 and 139.59.231[.]113. Though our global telemetry, we were able to enumerate other nodes that exhibited the same behavior characteristics, resulting in a total of 15 second-stage nodes.</p>
<h4>Observed Activity</h4>
<p>Our analysis indicates the threat actor used the infected machines to click on various Facebook and Google ads, and to interact with Microsoft Outlook. We suspect the first activity to be part of an advertising fraud effort, and the second activity is likely password spraying and/or data exfiltration. This global network of compromised SOHO routers gives cyber criminals the ability to bypass some standard network-based detection tools, especially those based on geolocation, autonomous system-based blocking, or IP address-based rate limiting.</p>
<h2>Global Telemetry Analysis</h2>
<h4>Bot Analysis</h4>
<p>Working from all second-stage IP addresses we could attribute to AVrecon, we searched our telemetry for connections over some of the previously mentioned ports such as 80, 8000 and 5178. When we compiled a list of distinct IP addresses that made at least one connection to one of the 15 servers, the results identified approximately 70,000 unique IP addresses.</p>
<p style="text-align: center;"><img decoding="async" loading="lazy" class="size-full wp-image-15542 aligncenter" src="http://blog.lumen.com/wp-content/uploads/2023/07/Figure3.jpg" alt="World map with of Number of Unique Bots per Country, most in US" width="814" height="475" /><span style="font-size: 10pt;">Figure 3: Global distribution of the bots.</span></p>
<p>Once we identified the global distribution, we sought to determine the average lifespan of the bots by calculating how often they communicate with one of the C2 nodes.</p>
<p style="text-align: center;"><img decoding="async" loading="lazy" class="alignnone size-full wp-image-15567" src="http://blog.lumen.com/wp-content/uploads/2023/07/Fig-4-Bot-comms-by-day.jpeg" alt=" Bot comms by day" width="930" height="221" /><br />
<span style="font-size: 10pt;">Figure 4: Graph showing the number of bots with total number of days they communicate with a C2 over a 28-day period.</span></p>
<p>Our analysis revealed that most IPs &#8211; more than 45,000 &#8211; only communicate with one of the C2s for one to two days. Since we knew there was no persistence mechanism inherent to the malware, we suspect these devices were most likely infected and remediated or otherwise abandoned. We characterized infections lasting more than two days as persistent, which gives us a botnet size of roughly 41,100 devices. We found the mean lifespan of a bot was just over seven days. This means the threat actor had a network of substantial size, in which any device could be used to tunnel malicious traffic at any time.</p>
<h4>Command and Control Analysis</h4>
<p>After inspecting traffic patterns at the bot-level, we examined the telemetry associated with the core set of 15 second stage servers. We found that, of this group, 12 communicated with one higher tier server located at 51.15.19[.]245 for 30 consecutive days. Using a tiered architecture for the backend is a tactic Black Lotus Labs has observed with other prominent botnets such as <a href="https://blog.lumen.com/emotet-redux/" target="_blank" rel="noopener">Emotet</a> and <a href="https://blog.lumen.com/emotet-redux/" target="_blank" rel="noopener">Qakbot</a>.</p>
<p>One rather interesting data point stuck out: when we scanned the higher-tier IP address on ports 25 and 465, it displayed the domain zerophone[.]cc. This domain was mentioned in the <a href="https://raw.githubusercontent.com/stamparm/maltrail/master/trails/static/malware/avrecon.txt" target="_blank" rel="noopener">historical write-up</a> on AVrecon from 2021 as part of the original analysis. The domain had a sample associated with it, which was compiled not only for ARM, but for MIPS and MIPSEL as well. This indicates the threat actor was targeting capabilities for the major SOHO router architectures on the market.</p>
<h2>Conclusion</h2>
<p>Black Lotus Labs remains on the cutting edge of monitoring network equipment and tracking large-scale botnets. This report on AVrecon unifies these two focus areas together to help better secure the internet ecosystem. The manner of attack seems to focus predominantly on stealing bandwidth – without impacting end-users – in order to create a residential proxy service to help launder malicious activity and avoid attracting the same level of attention from Tor-hidden services or commercially available VPN services. This class of cybercrime activity threat may evade detection because it is less likely than a crypto-miner to be noticed by the owner, and it is unlikely to warrant the volume of abuse complaints that internet-wide brute-forcing and DDoS-based botnets typically draw.</p>
<p>Black Lotus Labs has null-routed the AVrecon C2s across the Lumen global backbone and added the indicators of compromise (IoCs) from this campaign into the threat intelligence feed that fuels the Lumen Connected Security portfolio. We will continue to monitor new infrastructure, targeting activity and expanding TTPs, and we will continue to collaborate with the security research community to share findings related to this activity.</p>
<p>We encourage the community to monitor for and alert on these and any similar IoCs. We also advise the following:</p>
<p>Corporate Network Defenders:</p>
<ul>
<li>Continue to look for attacks on weak credentials and suspicious login attempts, even when they originate from residential IP addresses which bypass geofencing and ASN-based blocking.</li>
<li>While we have not observed subsequent exploitation directed towards the adjacent LAN thus far, the threat actors do have the ability to spawn a remote shell and deploy subsequent modules. While this type of activity has historically been observed in more advanced campaigns such as <a href="https://blog.lumen.com/zuorat-hijacks-soho-routers-to-silently-stalk-networks/" target="_blank" rel="noopener">ZuoRat</a> and <a href="https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/" target="_blank" rel="noopener">HiatusRat</a>, it remains an area ripe for exploitation.</li>
<li>Protect cloud assets from communicating with bots that are attempting to perform password spraying attacks, and begin blocking IoCs with Web Application Firewalls.</li>
</ul>
<p>Consumers with SOHO routers:</p>
<ul>
<li>Follow best practices by regularly rebooting routers and installing security updates and patches. Users should leverage properly configured and updated EDR solutions on hosts and regularly update software consistent with vendor patches where applicable.</li>
</ul>
<p>For additional IoCs associated with this campaign, please visit our <a href="https://github.com/blacklotuslabs/IOCs/blob/main/AVrecon_IOCs.txt" target="_blank" rel="noopener">GitHub page</a>.</p>
<p>If you would like to collaborate on similar research, please contact us on Twitter @BlackLotusLabs.</p>
<p>This analysis was performed by Danny Adamitis and Steve Rudd. Technical editing by Ryan English.</p>
<p><span style="font-size: 10pt;">This information is provided “as is” without any warranty or condition of any kind, either express or implied. Use of this information is at the end user’s own risk.</span></p>
<div class='yarpp yarpp-related yarpp-related-website yarpp-template-list'>
<!-- YARPP List -->
<h3>Related posts:</h3><ol>
<li><a href="https://blog.lumen.com/alina-point-of-sale-malware-still-lurking-in-dns/" rel="bookmark" title="Alina Point of Sale Malware Still Lurking in DNS">Alina Point of Sale Malware Still Lurking in DNS </a></li>
<li><a href="https://blog.lumen.com/zuorat-hijacks-soho-routers-to-silently-stalk-networks/" rel="bookmark" title="ZuoRAT Hijacks SOHO Routers to Silently Stalk Networks">ZuoRAT Hijacks SOHO Routers to Silently Stalk Networks </a></li>
<li><a href="https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/" rel="bookmark" title="New HiatusRAT router malware covertly spies on victims">New HiatusRAT router malware covertly spies on victims </a></li>
<li><a href="https://blog.lumen.com/emotet-redux/" rel="bookmark" title="Emotet Redux">Emotet Redux </a></li>
</ol>
</div>
				
				<div class="post_share_center">
				<div class="social_share_counter">
	<div class="social_share_counter_number">0</div>
	<div class="social_share_counter_label">Shares</div>
</div>
<div class="social_share_button_wrapper">
	<ul>
		<li><a class="tooltip facebook_share" title="Share On Facebook" target="_blank" href="https://www.facebook.com/sharer/sharer.php?u=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"><i class="fa fa-facebook"></i>Share On Facebook</a></li>
		<li><a class="tooltip twitter_share" title="Share On Twitter" target="_blank" href="https://twitter.com/intent/tweet?original_referer=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/&text=Routers from the Underground: Exposing AVrecon&url=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"><i class="fa fa-twitter"></i>Tweet It</a></li>
		<li><a class="tooltip pinterest_share" title="Share On Pinterest" target="_blank" href="http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F&media=https%3A%2F%2Fblog.lumen.com%2Fwp-content%2Fuploads%2F2023%2F07%2FAVrecon.jpg"><i class="fa fa-pinterest"></i></a></li>
		<li><a class="tooltip google_share" title="Share On Google+" target="_blank" href="https://plus.google.com/share?url=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"><i class="fa fa-google-plus"></i></a></li>
		<li><a class="tooltip email_share" title="Share by Email" href="mailto:?Subject=Routers+from+the+Underground%3A+Exposing+AVrecon&amp;Body=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F"><i class="fa fa-envelope"></i></a></li>
	</ul>
</div>
<Br class="clear"/>				</div>
				<hr/>
				
							</div>

		    			    <div class="post_excerpt post_tag">
			    	<i class="fa fa-tags"></i>
			    	<a href="https://blog.lumen.com/tag/black-lotus-labs/" rel="tag">Black Lotus Labs</a><a href="https://blog.lumen.com/tag/malware/" rel="tag">Malware</a><a href="https://blog.lumen.com/tag/router/" rel="tag">Router</a><br />			    </div>
						<br class="clear"/><br/>
			
			<div id="about_the_author">
    <div class="gravatar"><img data-del="avatar" src='https://blog.lumen.com/wp-content/uploads/2021/01/BLL-Square-No-Border-300x300.png' class='avatar pp-user-avatar avatar-200 photo ' height='200' width='200'/></div>
    <div class="author_detail">
     	<div class="author_content">
     		<div class="author_label">Author</div>
     		<h4>Black Lotus Labs</h4>
     		The mission of Black Lotus Labs is to leverage our network visibility to help protect customers and keep the internet clean.     		
		 	<ul class="author_social">
	     				    			    			    			    			 	</ul>
     	</div>
    </div>
    <br class="clear"/>
</div>
			
							<h5 class="single_subtitle">Trending Now</h5>
			  	<div class="post_trending">
									<div class="one_half ">
							<div class="post_wrapper grid_layout">
														<div class="post_img small static">
								    <a href="https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/">
								    									    	<img src="https://blog.lumen.com/wp-content/uploads/2023/07/AVrecon-700x466.jpg" alt="" class="" style="width:700px;height:466px;"/>
								    </a>
								</div>
														<div class="blog_grid_content">
									<div class="post_header grid">
									    <h6><a href="https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/" title="">Routers from the Underground: Exposing AVrecon</a></h6>
									    <div class="post_detail post_date">
								      		<span class="post_info_author">
								      											      			<a href="https://blog.lumen.com/author/black-lotus-labs/">Black Lotus Labs</a>
								      		</span>
								      		<span class="post_info_date">
								      			July 12, 2023								      		</span>
									  	</div>
									</div>
							    </div>
							</div>
						</div>
									<div class="one_half last">
							<div class="post_wrapper grid_layout">
														<div class="post_img small static">
								    <a href="https://blog.lumen.com/why-is-cybersecurity-critical-for-your-business-expansion/">
								    									    	<img src="https://blog.lumen.com/wp-content/uploads/2023/06/BLOG_CyberSecurity_Feature-848x566-1-700x466.jpg" alt="" class="" style="width:700px;height:466px;"/>
								    </a>
								</div>
														<div class="blog_grid_content">
									<div class="post_header grid">
									    <h6><a href="https://blog.lumen.com/why-is-cybersecurity-critical-for-your-business-expansion/" title="">Why is cybersecurity critical for your business expansion?</a></h6>
									    <div class="post_detail post_date">
								      		<span class="post_info_author">
								      											      			<a href="https://blog.lumen.com/author/darwin-hernandez/">Darwin Hernandez</a>
								      		</span>
								      		<span class="post_info_date">
								      			June 28, 2023								      		</span>
									  	</div>
									</div>
							    </div>
							</div>
						</div>
						  	</div>
						
						
						
						  	<h5 class="single_subtitle">You may also like</h5>
			  	<div class="post_related">
			    			       <div class="one_third ">
					   <!-- Begin each blog post -->
						<div id="post-15425" class="post-15425 post type-post status-publish format-standard has-post-thumbnail hentry category-black-lotus-labs category-security category-technologies tag-black-lotus-labs tag-malware tag-ransomware tag-social-engineering">
						
							<div class="post_wrapper grid_layout">
							
																
								   <div class="post_img small static">
								       <a href="https://blog.lumen.com/qakbot-retool-reinfect-recycle/">
								       									       	<img src="https://blog.lumen.com/wp-content/uploads/2023/05/Qakbot-700x466.jpg" alt="" class="" style="width:700px;height:466px;"/>
								       </a>
								   </div>
								
															    
							    <div class="blog_grid_content">
									<div class="post_header grid">
									    <strong><a href="https://blog.lumen.com/qakbot-retool-reinfect-recycle/" title="Qakbot: retool, reinfect, recycle">Qakbot: retool, reinfect, recycle</a></strong>
									    <div class="post_attribute info_date">
									        June 1, 2023									    </div>
									</div>
							    </div>
							    
							</div>
						
						</div>
						<!-- End each blog post -->
			       </div>
			     			       <div class="one_third ">
					   <!-- Begin each blog post -->
						<div id="post-15067" class="post-15067 post type-post status-publish format-standard has-post-thumbnail hentry category-about-lumen category-black-lotus-labs category-security category-technologies tag-black-lotus-labs tag-malware tag-router">
						
							<div class="post_wrapper grid_layout">
							
																
								   <div class="post_img small static">
								       <a href="https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/">
								       									       	<img src="https://blog.lumen.com/wp-content/uploads/2023/03/HiatusRAT-700x466.jpg" alt="" class="" style="width:700px;height:466px;"/>
								       </a>
								   </div>
								
															    
							    <div class="blog_grid_content">
									<div class="post_header grid">
									    <strong><a href="https://blog.lumen.com/new-hiatusrat-router-malware-covertly-spies-on-victims/" title="New HiatusRAT router malware covertly spies on victims">New HiatusRAT router malware covertly spies on victims</a></strong>
									    <div class="post_attribute info_date">
									        March 6, 2023									    </div>
									</div>
							    </div>
							    
							</div>
						
						</div>
						<!-- End each blog post -->
			       </div>
			     			       <div class="one_third last">
					   <!-- Begin each blog post -->
						<div id="post-14909" class="post-14909 post type-post status-publish format-standard has-post-thumbnail hentry category-security category-technologies category-uncategorized tag-black-lotus-labs tag-cybersecurity tag-ddos tag-lumen tag-ransomware tag-social-engineering">
						
							<div class="post_wrapper grid_layout">
							
																
								   <div class="post_img small static">
								       <a href="https://blog.lumen.com/5-observations-from-lumen-on-2022-attack-trends/">
								       									       	<img src="https://blog.lumen.com/wp-content/uploads/2023/02/22-Attack-Trends-700x466.jpg" alt="" class="" style="width:700px;height:466px;"/>
								       </a>
								   </div>
								
															    
							    <div class="blog_grid_content">
									<div class="post_header grid">
									    <strong><a href="https://blog.lumen.com/5-observations-from-lumen-on-2022-attack-trends/" title="5 Observations from Lumen on 2022 Attack Trends">5 Observations from Lumen on 2022 Attack Trends</a></strong>
									    <div class="post_attribute info_date">
									        February 6, 2023									    </div>
									</div>
							    </div>
							    
							</div>
						
						</div>
						<!-- End each blog post -->
			       </div>
			     			  	</div>
						
						
						
	    </div>
	    
	</div>

</div>
<!-- End each blog post -->



						
    	</div>

    		<div class="sidebar_wrapper">
    		
    			<div class="sidebar_top"></div>
    		
    			<div class="sidebar">
    			
    				<div class="content">

    							    	    		<ul class="sidebar_widget">
		    	    		<li id="custom_html-7" class="widget_text widget widget_custom_html"><h2 class="widgettitle"><span>Categories</span></h2>
<div class="textwidget custom-html-widget"><p><a href="https://blog.lumen.com/technologies/network/">Adaptive Networking</a></p>
<p><a href="https://blog.lumen.com/technologies/security/">Connected Security</a></p>
<p><a href="https://blog.lumen.com/technologies/cloud/">Hybrid Cloud</a></p>
<p><a href="https://blog.lumen.com/technologies/collaboration/">Communications and Collaboration</a></p>
<p><a href="https://blog.lumen.com/technologies/edge-compute/">Edge Computing</a></p>
<p><a href="https://blog.lumen.com/technologies/sase/">SASE</a></p></div></li>
		    	    		</ul>
		    	    	    				
    				</div>
    		
    			</div>
    			<br class="clear"/>
    	
    			<div class="sidebar_bottom"></div>
    		</div>
    
    </div>
    <!-- End main content -->
   
</div>

</div>




<div class="footer_bar   ">

		<div id="footer" class="">
	<ul class="sidebar_widget two">
	    <li id="text-2" class="widget widget_text">			<div class="textwidget"><p><img decoding="async" style="max-width: 220px; height: auto;" src="https://blog.lumen.com/wp-content/uploads/2020/09/Lumen-Logo.png" alt="" /></p>
<div>Lumen is guided by our belief that humanity is at its best when technology advances the way we live and work. With 450,000 route fiber miles serving customers in more than 60 countries, we deliver the fastest, most secure platform for applications and data to help businesses, government and communities deliver amazing experiences.</div>
<div style="margin-top: 15px;"><div class="social_wrapper shortcode light large"><ul><li class="facebook"><a target="_blank" title="Facebook" href="https://www.facebook.com/lumentechnologies" rel="noopener"><i class="fa fa-facebook"></i></a></li><li class="twitter"><a target="_blank" title="Twitter" href="http://twitter.com/lumentechco" rel="noopener"><i class="fa fa-twitter"></i></a></li><li class="youtube"><a target="_blank" title="Youtube" href="https://www.youtube.com/lumentechnologies" rel="noopener"><i class="fa fa-youtube"></i></a></li><li class="linkedin"><a target="_blank" title="Linkedin" href="https://www.linkedin.com/company/lumentechnologies/about/" rel="noopener"><i class="fa fa-linkedin"></i></a></li><li class="instagram"><a target="_blank" title="Instagram" href="http://instagram.com/lumentechnologies" rel="noopener"><i class="fa fa-instagram"></i></a></li></ul></div></div>
</div>
		</li>
	</ul>
	</div>
	<br class="clear"/>
	
	<div class="footer_bar_wrapper ">
			    <div id="copyright">Services not available everywhere. ©2022 Lumen Technologies. All Rights Reserved.</div>	    
	    	    	<a id="toTop"><i class="fa fa-angle-up"></i></a>
	    	    
	    	</div>
</div>

</div>


<div id="overlay_background">
	<div id="fullscreen_share_wrapper">
		<div class="fullscreen_share_content">
		<div id="social_share_wrapper">
	<ul>
		<li><a class="tooltip" title="Share On Facebook" target="_blank" href="https://www.facebook.com/sharer/sharer.php?u=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"><i class="fa fa-facebook marginright"></i></a></li>
		<li><a class="tooltip" title="Share On Twitter" target="_blank" href="https://twitter.com/intent/tweet?original_referer=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/&text=Routers from the Underground: Exposing AVrecon&url=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"><i class="fa fa-twitter marginright"></i></a></li>
		<li><a class="tooltip" title="Share On Pinterest" target="_blank" href="http://www.pinterest.com/pin/create/button/?url=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F&media=https%3A%2F%2Fblog.lumen.com%2Fwp-content%2Fuploads%2F2023%2F07%2FAVrecon.jpg"><i class="fa fa-pinterest marginright"></i></a></li>
		<li><a class="tooltip" title="Share On Google+" target="_blank" href="https://plus.google.com/share?url=https://blog.lumen.com/routers-from-the-underground-exposing-avrecon/"><i class="fa fa-google-plus marginright"></i></a></li>
		<li><a class="tooltip" title="Share by Email" href="mailto:?Subject=Routers+from+the+Underground%3A+Exposing+AVrecon&amp;Body=https%3A%2F%2Fblog.lumen.com%2Frouters-from-the-underground-exposing-avrecon%2F"><i class="fa fa-envelope marginright"></i></a></li>
	</ul>
</div>		</div>
	</div>
</div>

<div id="overlay_background_search">
	<a id="search_close_button" class="tooltip" title="Close" href="javascript:;"><i class="fa fa-close"></i></a>
	<div class="search_wrapper">
		<div class="search_content">
		    <form role="search" method="get" name="searchform" id="searchform" action="https://blog.lumen.com//">
		        <div>
		        	<input type="text" value="" name="s" id="s" autocomplete="off" placeholder="Enter Keyword"/>
		        	<div class="search_tagline">Press enter/return to begin your search</div>
		        	<button>
		            	<i class="fa fa-search"></i>
		            </button>
		        </div>
		        <div id="autocomplete"></div>
		    </form>
		</div>
	</div>
</div>



		<!-- Google Tag Manager (noscript) snippet added by Site Kit -->
		<noscript>
			<iframe src="https://www.googletagmanager.com/ns.html?id=GTM-TLWF636" height="0" width="0" style="display:none;visibility:hidden"></iframe>
		</noscript>
		<!-- End Google Tag Manager (noscript) snippet added by Site Kit -->
		<link rel='stylesheet' id='yarppRelatedCss-css' href='https://blog.lumen.com/wp-content/plugins/yet-another-related-posts-plugin/style/related.css' type='text/css' media='all' />
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/jquery/ui/core.min.js' id='jquery-ui-core-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/jquery/ui/mouse.min.js' id='jquery-ui-mouse-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/jquery/ui/slider.min.js' id='jquery-ui-slider-js'></script>
<script type='text/javascript' id='authors-list-js-js-extra'>
/* <![CDATA[ */
var authorsListAjaxSearch = {"ajaxurl":"https:\/\/blog.lumen.com\/wp-admin\/admin-ajax.php","nonce":"7dffce8401"};
/* ]]> */
</script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/authors-list/backend/assets/js/front.js' id='authors-list-js-js'></script>
<script type='text/javascript' id='ppress-frontend-script-js-extra'>
/* <![CDATA[ */
var pp_ajax_form = {"ajaxurl":"https:\/\/blog.lumen.com\/wp-admin\/admin-ajax.php","confirm_delete":"Are you sure?","deleting_text":"Deleting...","deleting_error":"An error occurred. Please try again.","nonce":"95bf5c5087","disable_ajax_form":"false","is_checkout":"0","is_checkout_tax_enabled":"0"};
/* ]]> */
</script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-user-avatar/assets/js/frontend.min.js' id='ppress-frontend-script-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/ilightbox.packed.js' id='ilightbox-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.easing.js' id='easing-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.sticky-kit.min.js' id='sticky-kit-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.lazy.min.js' id='lazy-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.cookie.js' id='cookie-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/jquery.tooltipster.min.js' id='tooltipster-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/custom_plugins.js' id='grandnews-custom-plugins-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/themes/grandnews/js/custom.js' id='grandnews-custom-script-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-review/public/js/js.cookie.min.js' id='js-cookie-js'></script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/underscore.min.js' id='underscore-js'></script>
<script type='text/javascript' id='wp-util-js-extra'>
/* <![CDATA[ */
var _wpUtilSettings = {"ajax":{"url":"\/wp-admin\/admin-ajax.php"}};
/* ]]> */
</script>
<script type='text/javascript' src='https://blog.lumen.com/wp-includes/js/wp-util.min.js' id='wp-util-js'></script>
<script type='text/javascript' id='wp_review-js-js-extra'>
/* <![CDATA[ */
var wpreview = {"ajaxurl":"https:\/\/blog.lumen.com\/wp-admin\/admin-ajax.php","loginRequiredMessage":"You must log in to add your review"};
/* ]]> */
</script>
<script type='text/javascript' src='https://blog.lumen.com/wp-content/plugins/wp-review/public/js/main.js' id='wp_review-js-js'></script>
</body>
</html>
